AP Cybersecurity topic 1.5
Leveraging AI in Cyber Defense
Defenders use AI to spot unusual behavior in huge amounts of log data, filter spam and phishing, and help analysts respond faster. AI can make mistakes: false positives waste time and false negatives let attacks through. Humans still review alerts and make final decisions.
Leveraging AI in Cyber Defense vocabulary
- Anomaly detection: Flagging activity that differs from normal patterns.
- False positive: An alert for something that is actually harmless.
- False negative: A real attack that the system misses.
- Human in the loop: Keeping a person responsible for reviewing and approving AI decisions.
AP-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. A district deploys an AI tool that learns normal login times and locations for each staff member and alerts when activity is unusual. Which of the following detection approaches does this tool use?
- (A) Signature-based detection
- (B) Anomaly-based detection
- (C) Physical detection
- (D) Manual log review
Show answer
(B) Anomaly-based detection Learning a baseline and flagging deviations is anomaly-based detection.
2. The AI tool flags a teacher who logs in at 11 p.m. to grade essays. No attack occurred. Which of the following best describes this alert?
- (A) True positive
- (B) False negative
- (C) False positive
- (D) True negative
Show answer
(C) False positive The alert fired, but the activity was harmless, so it is a false positive.
3. Which of the following best explains why a human analyst should review high-impact actions recommended by an AI security tool?
- (A) AI tools cannot read log files
- (B) AI tools can make mistakes, and blocking the wrong account could disrupt operations
- (C) Humans can review alerts faster than AI
- (D) AI tools only work during business hours
Show answer
(B) AI tools can make mistakes, and blocking the wrong account could disrupt operations Keeping a human in the loop catches AI errors before they cause harm.
4. Which of the following is the main advantage of using AI to triage thousands of security alerts each day?
- (A) It removes the need for any security staff
- (B) It ranks and groups alerts so analysts focus on the most likely real threats first
- (C) It prevents all false positives
- (D) It stops adversaries from using AI
Show answer
(B) It ranks and groups alerts so analysts focus on the most likely real threats first AI helps reduce alert fatigue by prioritizing, which speeds up response to real attacks.